• flutter 加密安全

    前言：数据安全

            数据的加密解密操作在 日常网络交互中经常会用到，现在密码的安全主要在于 秘钥的安全，如论 DES 3DES  AES 还是 RSA, 秘钥的算法（计算秘钥不固定） 和 保存，都决定了你的数据安全；但是常见的逆向操作 比如 hook 加密算法 都很容易拿到 秘钥； 这个时候我们可以 回溯到 之前的 古典密码学（依赖算法本身），基本思路  置换 移位 编码 等等手段 来配合 加密算法一起使用，提高我们应用的安全；

    密码学概论_在传统的密码学中,加解密基础操作包括移位置换替换编码-CSDN博客文章浏览阅读201次。密码学基础_在传统的密码学中,加解密基础操作包括移位置换替换编码https://blog.csdn.net/nicepainkiller/article/details/132978492?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522170902384916777224453245%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=170902384916777224453245&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-132978492-null-null.nonecase&utm_term=%E5%AF%86%E7%A0%81&spm=1018.2226.3001.4450

    android frida 逆向 自吐加密算法_frida 自吐算法 教程-CSDN博客文章浏览阅读1.8k次。frida hook android Android 逆向神器_frida 自吐算法 教程https://blog.csdn.net/nicepainkiller/article/details/132554698?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522170902437216800182198144%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=170902437216800182198144&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-132554698-null-null.nonecase&utm_term=hook&spm=1018.2226.3001.4450

     flutter 数据加密

    如果是 android 原生应用，可以 hook 系统加密代码，来获取加密秘钥，而在 flutter 中，dart 是被直接编译为 .so 文件，也就是汇编，对于低级汇编语言 可读性大大降低。当然也是可以下断点动态调试的；但是相对于难度 大大增加，我们可以结合 古典密码学 主要特点 数据安全基于算法的保密，算法不公开， 设计繁琐的算法过程，增加汇编可读性难度；

    有个业务需求是：相当于是一个签到功能，每天可以领取，这里防止脚本调用使用两层 基于算法加密 和 AES加密 相结合的方式；（当然还用到了第三方的的安全软件）

    以下是我上个版本加密算法设计：整体思路就是：

    • 按照规则 移动字符 替换字符
    • 阶段一主要是 按规则打乱字符（密文）位置
    • 阶段二主要是 指定位置（密文）插入无关字符

    match_request_data.dart

    1. import 'dart:convert';
    2. import 'package:crypto/crypto.dart';
    3. import 'package:encrypt/encrypt.dart' as encrypt;
    4.  
    5. ///匹配接口加密工具类
    6. ///整体加密思路：按照规则 移动字符 替换字符
    7. ///阶段一主要是 按规则打乱字符位置
    8. ///阶段二主要是 指定位置插入无关字符
    9. class MatchRequestData {
    10.   final String gameId;
    11.   final String chatSign;
    12.   final String nickName;
    13.   late List<int> _gameIdSort;
    14.   MatchRequestData(
    15.       {required this.gameId, required this.chatSign, required this.nickName});
    16.  
    17.   String generateCode(String datum) {
    18.     String idStr = '${int.parse(gameId)}';
    19.     List<int> searchKeywords =
    20.         List<int>.generate(idStr.length, (index) => int.parse(idStr[index]));
    21.     searchKeywords.sort();
    22.     _gameIdSort = searchKeywords;
    23.  
    24.     String base64 = _encodeBase64(datum);
    25.     String base64Step0 =
    26.         base64.substring(0, _gameIdSort[_gameIdSort.length - 1]) +
    27.             _stepOne((base64.substring(
    28.                 _gameIdSort[_gameIdSort.length - 1],
    29.                 base64.length -
    30.                     _gameIdSort[3] -
    31.                     _gameIdSort[_gameIdSort.length - 1]))) +
    32.             base64.substring(base64.length -
    33.                 _gameIdSort[3] -
    34.                 _gameIdSort[_gameIdSort.length - 1]);
    35.  
    36.     String _strHex = _strToHex(base64Step0);
    37.     final key = encrypt.Key.fromUtf8(_generateMd5(chatSign + nickName));
    38.     final iv = encrypt.IV.fromUtf8(_ivStepOne().substring(4, 20).toUpperCase());
    39.     final encrypter =
    40.         encrypt.Encrypter(encrypt.AES(key, mode: encrypt.AESMode.cbc));
    41.     final encrypted = encrypter.encrypt(_strHex, iv: iv);
    42.     final encryptCode = _stepTwo(encrypted.base64);
    43.     idStr = _strHex = base64 = base64Step0 = '';
    44.     return encryptCode;
    45.   }
    46.  
    47.   String _stepOne(String str) {
    48.     String res = '';
    49.     str = _inverse(str);
    50.     int lastPosition = _gameIdSort[_gameIdSort.length - 1];
    51.     int count = 0;
    52.     if (lastPosition % 2 == 0) {
    53.       count = _gameIdSort[_gameIdSort.length - 2];
    54.     } else {
    55.       count = _gameIdSort[_gameIdSort.length - 3];
    56.     }
    57.     if (count == 0) {
    58.       count = lastPosition;
    59.     }
    60.     int step = str.length ~/ count;
    61.     List<String> base64Parts = [];
    62.     for (int i = 0; i < count; i++) {
    63.       if (i % 2 == 1) {
    64.         base64Parts.add(_inverse(str.substring(step * i, step * (i + 1))));
    65.       } else {
    66.         base64Parts.add(str.substring(step * i, step * (i + 1)));
    67.       }
    68.     }
    69.     if (step * count < str.length) {
    70.       if (lastPosition % 2 == 0) {
    71.         base64Parts.insert(0, str.substring(step * count));
    72.       } else {
    73.         base64Parts.insert(base64Parts.length, str.substring(step * count));
    74.       }
    75.     }
    76.     if (lastPosition % 2 == 1) {
    77.       for (int i = 0; i < base64Parts.length; i++) {
    78.         res = res + base64Parts[i];
    79.       }
    80.     } else {
    81.       for (int i = base64Parts.length - 1; i >= 0; i--) {
    82.         res = res + base64Parts[i];
    83.       }
    84.     }
    85.     str = '';
    86.     lastPosition = count = step = -1;
    87.     return res;
    88.   }
    89.  
    90.   String _stepTwo(String data) {
    91.     String res = "";
    92.     String _strHex = _strToHex(data);
    93.     String _code = _inverse(_strHex);
    94.     final key = encrypt.Key.fromUtf8(_generateMd5(gameId + chatSign));
    95.     final iv = encrypt.IV.fromUtf8(_ivStepTwo().substring(14, 30));
    96.     final encrypter =
    97.         encrypt.Encrypter(encrypt.AES(key, mode: encrypt.AESMode.cbc));
    98.     final encrypted = encrypter.encrypt(_code, iv: iv);
    99.     res = encrypted.base64;
    100.     int maxLength = res.length;
    101.  
    102.     int indexSub = 0;
    103.     int insertPos = 0;
    104.     String insertStr = '';
    105.     for (int i = 1; i < _gameIdSort.length; i++) {
    106.       indexSub = _gameIdSort[i] + 1;
    107.       insertPos = _magic(indexSub + i) + i * 11 + i - 1;
    108.       // insertStr = chatSign.substring(1,indexSub);
    109.       insertStr = chatSign[indexSub];
    110.       //前面插入
    111.       if (insertPos > res.length) {
    112.         insertPos = maxLength;
    113.       }
    114.       res =
    115.           '${res.substring(0, insertPos)}$insertStr${res.substring(insertPos)}';
    116.     }
    117.     _strHex = _code = '';
    118.     return res;
    119.   }
    120.  
    121.   String _stepThree(String str) {
    122.     return str;
    123.   }
    124.  
    125.   String _inverse(String tag) {
    126.     String res = '';
    127.     List<String> searchKeywords =
    128.         List<String>.generate(tag.length, (index) => tag[index]);
    129.     Iterable<String> array = searchKeywords.reversed;
    130.     for (var e in array) {
    131.       res = '$res$e';
    132.     }
    133.     return res;
    134.   }
    135.  
    136.   String _ivStepOne() {
    137.     String res = '';
    138.     String map = _generateMd5(chatSign) + _generateMd5(nickName);
    139.     int index = _gameIdSort[_gameIdSort.length - 2];
    140.     while (res.length < 50) {
    141.       res += map[index];
    142.       index++;
    143.     }
    144.     index = 0;
    145.     return res;
    146.   }
    147.  
    148.   String _ivStepTwo() {
    149.     String res = '';
    150.     String map = _generateMd5(_inverse(chatSign)) + _generateMd5(chatSign);
    151.     int index = _gameIdSort[_gameIdSort.length - 1];
    152.     while (res.length < 50) {
    153.       res += map[index];
    154.       index++;
    155.     }
    156.     index = 0;
    157.     return _inverse(res);
    158.   }
    159.  
    160.   /// 字符串转 十六进制
    161.   String _strToHex(String str) {
    162.     List<int> charCodes = str.runes.toList();
    163.     return charCodes.map((code) => code.toRadixString(16)).join('');
    164.   }
    165.  
    166.   /// 字符串转 base64
    167.   String _encodeBase64(String data) {
    168.     return base64Encode(utf8.encode(data));
    169.   }
    170.  
    171.   /// base64转 普通字符
    172.   String _decodeBase64(String data) {
    173.     return String.fromCharCodes(base64Decode(data));
    174.   }
    175.  
    176.   String _generateMd5(String str) {
    177.     return md5.convert(utf8.encode(str)).toString();
    178.   }
    179.  
    180.   int _magic(int num) {
    181.     if (num < 3) {
    182.       return 1;
    183.     } else {
    184.       return _magic(num - 1) + _magic(num - 2);
    185.     }
    186.   }
    187. }

    调用的地方：

    1. MatchRequestData data = MatchRequestData (
    2.   gameId: userArray[i]['gameID'],
    3.   chatSign: userArray[i]['chatSign'],
    4.   nickName: userArray[i]['nickName'],
    5. );
    6.  
    7. //需要传递给后台的 内容
    8. Map datum = {
    9.   'inTrust': 'TRUE',
    10.   'time': DateTime.now().millisecondsSinceEpoch,
    11.   'GameID': userArray[i]['gameID'],
    12.   'nickName': userArray[i]['nickName'],
    13.   'MachineCode':
    14.       md5.convert(utf8.encode(userArray[i]['gameID'])).toString(),
    15.   'sign': md5
    16.       .convert(
    17.           utf8.encode(userArray[i]['gameID'] + userArray[i]['chatSign']))
    18.       .toString(),
    19. };
    20.  
    21.  
    22. String res = data.generateCode(jsonEncode(datum));

    服务端的数据解密：

    服务端为 .net 框架：

    对应于加密算法写的解密算法：

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Security.Cryptography;
    4. using System.Text;
    5.  
    6. namespace ToMatch
    7. {
    8.     public class MatchEncrypt
    9.     {
    10.         private string gameID;
    11.         private string chatSign;
    12.         private string nickName;
    13.         private List<int> idSort;
    14.  
    15.         /// <summary>
    16.         /// 匹配构造函数
    17.         /// </summary>
    18.         /// <param name="gameId">GameID</param>
    19.         /// <param name="chatSign">签名</param>
    20.         /// <param name="nickName">昵称</param>
    21.         public MatchEncrypt(string gameId, string chatSign, string nickName) {
    22.             this.gameID = gameId;
    23.             this.chatSign = chatSign;
    24.             this.nickName = nickName;
    25.  
    26.             this.idSort = new List<int>();
    27.             string idStr = int.Parse(this.gameID).ToString();
    28.             for (int i = 0; i < idStr.Length; i++)
    29.             {
    30.                 this.idSort.Add((int)Char.GetNumericValue(idStr[i]));
    31.             }
    32.             this.idSort.Sort();
    33.         }
    34.  
    35.  
    36.  
    37.  
    38.         private String IvStepOne {
    39.             get {
    40.                 String res = "";
    41.                 String map = Md5Hash(chatSign) + Md5Hash(nickName);
    42.                 int index = idSort[idSort.Count - 2];
    43.                 while (res.Length < 50)
    44.                 {
    45.                     res += map[index];
    46.                     index++;
    47.                 }
    48.                 return res;
    49.             }
    50.         }
    51.  
    52.         private String IvStepTwo
    53.         {
    54.             get
    55.             {
    56.                 String res = "";
    57.                 String map = Md5Hash(AESHelper.Inverse(chatSign),false) + Md5Hash(chatSign,false);
    58.                 int index = idSort[idSort.Count - 1];
    59.                 while (res.Length < 50)
    60.                 {
    61.                     res += map[index];
    62.                     index++;
    63.                 }
    64.                 return AESHelper.Inverse(res);
    65.             }
    66.         }
    67.  
    68.  
    69.         /// <summary>
    70.         /// 解密客户端内容
    71.         /// </summary>
    72.         /// <param name="code">密文</param>
    73.         /// <returns></returns>
    74.         public string Resolver(string code) {
    75.  
    76.             //第一阶段解密内容
    77.             string resStepOne = StepOne(code);
    78.  
    79.             if (resStepOne.Length > 0)
    80.             {
    81.                 //Console.WriteLine("第一解密 result:" + resStepOne);
    82.                 //第二阶段解密
    83.                 string resSteptwo = Steptwo(resStepOne);
    84.                 //Console.WriteLine("第二解密 result:" + resSteptwo);
    85.                 //Console.WriteLine(AESHelper.FromBase64(resSteptwo));
    86.                 if (resSteptwo.Length > 0)
    87.                 {
    88.                     return AESHelper.FromBase64(resSteptwo);
    89.                 }
    90.                 else 
    91.                 {
    92.                     return "解密失败——请记录日志.Step-2";
    93.                 }       
    94.             }
    95.             else {
    96.                 return "解密失败——请记录日志.Step-1";
    97.             }            
    98.         }
    99.  
    100.  
    101.         private string StepOne(string code)
    102.         {
    103.             // 1.先移除插入的字符
    104.             // 2.再进行解密操作
    105.             int maxlength = code.Length - idSort.Count - 1;
    106.             int indexSub = 0;
    107.             int insertPos = 0;
    108.    
    109.             for (int i = 1; i < idSort.Count; i++)
    110.             {
    111.                 indexSub = idSort[i] + 1;
    112.                 insertPos = magic(indexSub + i) + i * 11;    
    113.                 //前面插入
    114.                 //Console.WriteLine("前面    索引:" + i);
    115.                 //Console.WriteLine("前面插入位置:" + insertPos);
    116.                 //Console.WriteLine("前面插入字符:" + insertStr + "");
    117.   
    118.                 if (insertPos > code.Length) {
    119.                     //Console.WriteLine("修正Length:" + code.Length);
    120.                     Console.WriteLine("修正insertPos:" + insertPos);
    121.                     //Console.WriteLine("----code.Length:" + (code.Length -maxlength  ));
    122.                     //Console.WriteLine("----code.Length:" + (  idSort.Count-1 - i));
    123.                     //Console.WriteLine("----code.Length:" + ((code.Length - maxlength - (idSort.Count - 1 - i))+1));
    124.                     insertPos = maxlength -4;
    125.                     insertPos = maxlength - ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1);
    126.                     //Console.WriteLine("*******code.Length:" + ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1));
    127.                     //Console.WriteLine("*******code.Length:" + (code.Length - maxlength - (idSort.Count - i)) );
    128.                     //Console.WriteLine("*******code.Length:" + (code.Length - maxlength - idSort.Count  - i ));
    129.                     //Console.WriteLine("code.Length:" + code.Length);
    130.                     //Console.WriteLine("maxlength:" + maxlength);
    131.                     //Console.WriteLine("idSort.Count:" + idSort.Count);
    132.                     //Console.WriteLine("idSort.Count - i:" + (idSort.Count - i));
    133.                     //Console.WriteLine("修正插入位置i:" + i);
    134.                     //Console.WriteLine("修正插入位置:" + insertPos);
    135.                     insertPos = maxlength - ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1);
    136.                 }              
    137.                 code = code.Substring(0, insertPos) + code.Substring(insertPos + 1);
    138.             }
    139.  
    140.             //Console.WriteLine("整理后的:" + code);
    141.             //Console.WriteLine("整理后的Length:" + code.Length);
    142.             string key = Md5Hash(this.gameID + this.chatSign, false);
    143.             string iv = IvStepTwo.Substring(14, 16);
    144.  
    145.             //第一次解密是 16进制字符串
    146.             string result = AESHelper.Decrypt(code, key, iv);
    147.             return AESHelper.HexStringToString(AESHelper.Inverse(result), Encoding.UTF8);
    148.         }
    149.  
    150.         private string Steptwo(string code) {
    151.  
    152.             string key = Md5Hash(this.chatSign + this.nickName, false);
    153.             string iv = IvStepOne.Substring(4, 16);
    154.  
    155.       
    156.  
    157.             string base64 = AESHelper.HexStringToString(AESHelper.Decrypt(code, key, iv), Encoding.UTF8);
    158.             
    159.             string source = base64.Substring(0, idSort[idSort.Count - 1]) + generateMid(base64.Substring(idSort[idSort.Count - 1], base64.Length - idSort[3] - idSort[idSort.Count - 1] * 2)) + base64.Substring(base64.Length - idSort[3] - idSort[idSort.Count - 1]);
    160.  
    161.             //第二次解密是 base64
    162.             return source ;
    163.         }
    164.  
    165.  
    166.         private string generateMid(string str) {
    167.  
    168.             string res = "";
    169.             List<String> base64Parts = new List<string>();
    170.             int lastPosition = this.idSort[this.idSort.Count - 1];
    171.             string subBefore = "";
    172.             int count = 0;
    173.             if (lastPosition % 2 == 0)
    174.             {
    175.                 count = idSort[idSort.Count - 2];
    176.             }
    177.             else
    178.             {
    179.                 count = idSort[idSort.Count - 3];
    180.             }
    181.             if (count == 0) {
    182.                 count = lastPosition;
    183.             }
    184.             int step = str.Length / count;
    185.  
    186.             int subLength = str.Length - step * count;
    187.  
    188.             if (lastPosition % 2 == 0)
    189.             {
    190.                 for (int i = 0; i < count; i++)
    191.                 {
    192.                     if (i % 2 == 1)
    193.                     {
    194.                         base64Parts.Add(AESHelper.Inverse(str.Substring(step * (count - i - 1), step)));
    195.                     }
    196.                     else
    197.                     {
    198.                         //base64Parts.Add(v.Substring(step * i, step));
    199.                         //Console.WriteLine(i + "不需要翻转原始：" + str.Substring(step * (count - i - 1), step));
    200.                         base64Parts.Add(str.Substring(step * (count - i - 1), step));
    201.                     }
    202.                 }
    203.  
    204.                 for (int i = 0; i < base64Parts.Count; i++)
    205.                 {
    206.                     //Console.WriteLine("偶数项目：" + i + " " + base64Parts[i]);
    207.                     res = res + base64Parts[i];
    208.                 }
    209.                 subBefore = str.Substring(step * count);
    210.                 res += subBefore;
    211.             }
    212.             else
    213.             {
    214.                 for (int i = 0; i < count; i++)
    215.                 {
    216.                     if (i % 2 == 1)
    217.                     {
    218.                         base64Parts.Add(AESHelper.Inverse(str.Substring(step * i, step)));          
    219.                     }
    220.                     else
    221.                     {
    222.                         base64Parts.Add(str.Substring(step * i, step));
    223.                     }
    224.                 }
    225.                 subBefore = str.Substring(step * count);
    226.                 base64Parts.Add(subBefore);
    227.                 for (int i = 0; i < base64Parts.Count; i++)
    228.                 {
    229.                     //Console.WriteLine("奇数项目：" + i + " " + base64Parts[i]);
    230.                     res = res + base64Parts[i];
    231.                 }
    232.             }
    233.  
    234.             return AESHelper.Inverse(res);
    235.         }
    236.  
    237.         private static int magic(int num)
    238.         {
    239.  
    240.             if (num < 3)
    241.             {
    242.                 return 1;
    243.             }
    244.             else
    245.             {
    246.                 return magic(num - 1) + magic(num - 2);
    247.             }
    248.         }
    249.  
    250.         private string Md5Hash(string sourceText, bool toUpper = true)
    251.         {
    252.             StringBuilder result = new StringBuilder();
    253.             using (MD5 md5 = new MD5CryptoServiceProvider())
    254.             {
    255.                 byte[] data = md5.ComputeHash(Encoding.UTF8.GetBytes(sourceText));
    256.                 if (toUpper)
    257.                     for (int i = 0; i < data.Length; i++)
    258.                         result.Append(data[i].ToString("X2"));
    259.                 else
    260.                     for (int i = 0; i < data.Length; i++)
    261.                         result.Append(data[i].ToString("x2"));
    262.             }
    263.             return result.ToString();
    264.         }
    265.     }
    266. }

     总结

    数据安全不是绝对的，只能说我们多设置些障碍，对于逆向的难度对增大，你挖的坑多远。逆向时候就越困难，当然也可以借助一些第三方安全软件来增加我们数据的安全性。在数据安全的道路上 始终是此消彼长的状态

  • 相关阅读:
    STM32玩矩阵开关（输入和输出）
    神经网络实现AND门：逻辑运算的智能化飞跃
    回调函数的简单使用0717
    微服务框架 SpringCloud微服务架构 17 初识ES 17.6 安装IK 分词器
    蓝桥杯官网练习题（谈判）
    波兰计算器的实现(代码实现) [数据结构][Java]
    PGSQL的on conflict
    Day.js 常用方法 以后再也不用new Date( )啦
    聊聊redis分布式锁的8大坑
    Apache OFBiz 路径遍历导致RCE漏洞复现（CVE-2024-36104）
  • 原文地址：https://blog.csdn.net/nicepainkiller/article/details/136326876